The Digital Health Act 2023: What It Means for Your Hospital System

Compliance · 8 min read · Updated 2026-10-19

For most of the last decade, choosing a hospital management system in Kenya was a private decision between a facility and its vendor. The Digital Health Act 2023 changed that. It is one of the four health laws passed in 2023, alongside the Social Health Insurance Act, the Primary Health Care Act and the Facility Improvement Financing Act, and it sets the rules for how health data is held, shared and protected across the country.

This guide covers what the Act means in practice for a facility and for the software it runs on. It is not legal advice, and the regulations under the Act are still being implemented, so check the current position with the Digital Health Agency before relying on any detail.

What the Act sets up

The Act establishes the Digital Health Agency (DHA) to run the national digital health infrastructure. The parts that matter most to a facility are:

  • A national health information exchange, so records can move between facilities, insurers and the Ministry rather than being re-created at each one.
  • A Shared Health Record, a summary of a patient's care that follows them between facilities.
  • Registries: of clients (patients), of health facilities and of health workers, so a patient, a facility and a practitioner are identified the same way everywhere.
  • Standards that systems must meet in order to connect.
  • Protection of health data as a special category, building on the Data Protection Act 2019.

Interoperability is no longer optional

The practical consequence for software is interoperability. A system that keeps everything in its own format and exports a PDF at best will not be able to take part in the exchange.

Kenya has adopted HL7 FHIR as the exchange standard and publishes a Kenya Core FHIR implementation guide describing how patients, encounters, observations, conditions, medications and other resources must be represented. A system connects to the exchange by producing and accepting data in that shape, and the DHA tests systems against it.

What that means for you:

  • Your data has to be structured. Diagnoses coded rather than typed, vitals as numbers rather than sentences, medications from a catalogue rather than free text. A system that cannot do this cannot produce valid FHIR, however good its screens look.
  • Identity has to be right. National ID and other identifiers captured at registration, in the right fields, so the client registry can match the patient.
  • Consent has to be recorded. Sharing a record to the Shared Health Record should follow a recorded consent, tied to the encounter.

Data protection

The Act treats health data as sensitive and expects facilities to protect it accordingly. In practice that means role-based access, a log of who viewed which record, data held in a way that a breach at one facility does not expose another, and a lawful basis for every disclosure. Our guide to the Data Protection Act and patient data covers the obligations in detail, including registration with the ODPC.

Questions to ask your vendor

  1. Does the system produce FHIR resources that validate against the published Kenya Core implementation guide, and can you show us a validation result?
  2. Has the system been submitted to the Digital Health Agency for testing, and what is its current status? Ask for the actual status rather than "we are compliant".
  3. How are diagnoses coded? ICD-11, and mapped to the MOH reporting lines?
  4. Where is our data hosted, how is it isolated from other customers, and how is it backed up?
  5. Is every access to a patient record logged, and can we export that log?
  6. How is patient consent to share a record captured?

A vendor that cannot answer those clearly is selling a system that will need replacing.

Where AfyaConnect stands

AfyaConnect produces FHIR R4 resources built to the Kenya Core implementation guide, codes diagnoses in ICD-11 mapped to MOH lines, captures national identifiers at registration, records consent against the encounter and logs every record access. It is going through the Digital Health Agency's testing process; we will say it is certified when it is, and not before.

If you are choosing a system now, our buyer's guide to hospital management systems in Kenya covers the rest of the evaluation, and register your facility to see how a record is captured and shared.

Related guides